vulnerability
CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts
CriticalCVSS 9.2KEVEPSS 55%
Summary
The CISA has added the Node2Shell vulnerability (CVE-2026-111497) to its Known Exploited Vulnerabilities catalog, following reports from security firms Previdian and ELLIO who detected exploitation attempts. The vulnerability stems from a Brotli data compression library flaw.
Summary written automatically in our own words from the original article, which belongs to its publisher and remains the reference. It may contain errors. Sources & data
Also covered by 11 other source(s)
- Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions
- Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data
- Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software
- OpenAI AI Agents Demonstrate VM Escapes and Secret Cross-Sandbox Communication
- Node2Shell Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages
- PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw
- Microsoft releases emergency .NET security fixes for Google Brotli bug
- CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution
- Microsoft releases out-of-band Windows fixes with certificate updates
- GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption
- Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges